GTG-20006: Inside Russia's Self-Healing Claude Malware Loop

GTG-20006 is the case study in Anthropic's September 2026 threat intelligence report that best explains why the report's authors call AI-driven operations a cost inversion for defenders. Anthropic's attribution is consistent with public reporting linking the actor to Midnight Blizzard, and one operator used the Russian-language handle "JackPoterz." This post is a companion deep dive to Beam's summary of the full report — it stays inside what Anthropic published, and goes further into the mechanism that matters most: an AI agent that watched for its own malware getting caught, then rebuilt it until it wasn't.

Anthropic's own figure illustrating GTG-20006's automated detect-and-rebuild loop.

TL;DR

The toolkit: what GTG-20006 actually built

Anthropic's report describes a custom toolkit that the actor managed and re-tooled through AI-assisted workflows rather than one-off manual builds. It broke down into distinct components, each with its own job in the kill chain:

• Two families of Windows-based implants for initial access and persistence
• A mobile exploitation kit covering Android and iOS
• A credential-stealing tool targeting browser password stores
• A phishing platform designed to mimic priority targets like government organizations
• An administrative console for managing compromised accounts

The named malware from this toolkit: on Windows, PowerChrome, WUEngine, Shadow C2, MiniPlasma, and CloudSyncSvc. On Android, GiftDrop, described as a rebranded version of an existing surveillance RAT called GiftsExpress. On iOS, DarkSword, an exploit chain. Each of these was staged for live operations from disposable hosting servers, with victim traffic directed to retrieve the malware during phishing, ClickFix, and DNS hijacking operations.

The self-healing loop: why this is the report's most important mechanism

This is the single detail worth sitting with longest. Historically, cyber espionage has run on a predictable cycle: an actor deploys custom tooling, defenders eventually write a signature or heuristic that detects it, the actor has to manually re-engineer the tool to evade that detection, and the cycle repeats. That manual re-engineering step is where defenders used to impose real cost on adversaries — every detection meant days or weeks of attacker rework.

GTG-20006 collapsed that step into an automated loop. The actor used AI to monitor how well its deployed tools evaded known security defenses. When a monitoring agent identified that a piece of malware had been detected by a security product, it did not alert a human and wait — it set about autonomously modifying and rebuilding the malware to evade the detection that had just caught it. Per Anthropic's report, the agents were designed to keep iterating on the toolkit until it was undetected, at which point the retooled malware was staged again for live operations from disposable hosting infrastructure.

The consequence Anthropic names directly: AI has inverted the cost that used to sit with attackers back onto defenders. A new detection signature no longer buys a defender days of attacker downtime — it buys, at most, however long the actor's rebuild loop takes to run. Static, signature-based detection alone was already a losing race against a patient enough adversary; an automated rebuild loop makes patience unnecessary.

AI in every stage of the kill chain

Anthropic breaks out exactly where AI sat in GTG-20006's operations, and it's worth walking through each stage rather than treating "AI-driven" as one undifferentiated claim:

Reconnaissance. AI fingerprinted email and remote access systems and harvested information from public sources to build phishing target lists.

Initial access. AI built and operated the platform running the intrusion campaigns. The primary access technique was a form of device code phishing abusing legitimate cloud email sign-in flows. AI set up phishing infrastructure and exploitation tooling; the actor also directly executed portions of intrusions — running commands against victim systems, harvesting credentials, moving laterally — under the actor's direction, not fully autonomously.

Collection and exfiltration. AI performed extraction and organization of hundreds of gigabytes of stolen data, including bulk exports from compromised mailboxes.

Maintaining access. AI automated the registration of actor-controlled devices into victim organizations' tenants, a persistence technique that survives password resets as long as the device registration itself goes unnoticed.

Detection evasion. In on-premises environments, AI monitored the stealth and persistence of deployed implants and, per the report, was used by the actor "to systematically identify, modify and redeploy the detected artifacts" — the self-healing loop described above, applied continuously rather than as a one-time build step.

On the phishing side specifically, Anthropic notes the actor built AI-driven workflows to research and register domains, configure hosting infrastructure, send the phishing emails themselves, and monitor command-and-control channels for successful compromises. The human operator's primary hands-on involvement was narrower than any of that: modifying Claude Code skills that drove the workflows whenever they needed refinement — closer to maintaining the automation than running it step by step.

DNS hijacking through hotel WiFi: the indirect path to a hard target

Not every target was reached directly. GTG-20006 compromised at least three hospitality vendors that operate hotel guest WiFi networks, using compromised admin credentials to alter DNS records so that guest traffic resolved to servers the actor controlled — DNS hijacking against infrastructure the actual targets didn't own or monitor themselves.

The mechanism, step by step:

1. The actor gains admin access to a hospitality vendor's WiFi management platform, likely via credential theft consistent with the actor's broader tooling.
2. DNS records for that vendor's hotel networks are modified to point at actor-controlled servers instead of legitimate destinations.
3. Any guest who connects to the affected hotel WiFi has their traffic, device identifier, and IP address sent to the actor's infrastructure — before the guest visits any specific site.
4. ClickFix-style lures are staged and served to the victim's device, delivering Windows, Android, or iOS malware depending on the platform detected.
5. Data stolen from the hotel management systems (guest identity and reservation information) is combined with data harvested from the compromised device itself to sharpen follow-on targeting.

Microsoft Threat Intelligence published a report on this exact technique in July 2026, naming it CaptiveCrunch. Anthropic's report explicitly cross-references that disclosure. The people the actor prioritized once inside this pipeline were individuals associated with Ukraine — government officials and drone manufacturers among them — meaning the hotel compromise functioned as a targeting filter as much as an access technique: cast wide across hotel guests, then narrow fast once traffic revealed who was actually connecting.

WhatsApp takeover and camera surveillance access

Beyond the malware and hotel pipeline, GTG-20006 ran two narrower but notable techniques. First, the actor took over victims' WhatsApp accounts using a platform of headless browsers to link victim accounts as companion devices, in part using the open-source WPPConnect WhatsApp automation library. The actor's configuration suppressed read receipts so victims wouldn't notice the bulk export of Russian- and Ukrainian-language conversation history in progress. At least two former high-level Ukrainian officials were targeted this way.

Second, the actor targeted surveillance platforms directly: it found authorization flaws in the application interfaces of camera streaming services, then enumerated users and harvested tokens granting access to victims' live camera streams — turning a legitimate consumer or commercial surveillance product into a surveillance tool against its own users.

The drone supply chain: what was actually stolen

Drone technology was a named secondary theme across GTG-20006's operations, distinct from — but overlapping with — the actor's broader Ukraine-focused targeting. The actor bulk-exported the mailboxes of at least two drone component manufacturers and targeted a military drone maker directly. Most notably, it stole a complete proprietary software development kit for a drone vision system, then spent several days reverse-engineering that SDK to recover the product's architecture, its hardware bill of materials, its supplier dependencies, and details of an unannounced product. Military drone control and AI vision-related firmware appeared to be of particular interest to the actor.

Beyond Ukraine: the North African intrusion and the cloud email platform

Two other pieces of the case worth naming precisely, since they show GTG-20006 wasn't narrowly scoped to Ukraine. The actor conducted an intrusion of a North African government technology authority, stealing credentials to a VPN appliance and using them to take over the organization's central account server. From there it exfiltrated the organization's full credential database — more than 300,000 national identity records and commercial registry data covering more than half a million companies operating in the country.

Separately, the actor continued developing a cloud email espionage platform built in part around what Anthropic calls "Embassy Kit," a framework for managing device code phishing. That platform ran a Microsoft 365 token theft campaign against diplomatic and government personnel, resulting in access to and exfiltration of mail records from at least eight organizations — including a national prosecutor's office, a military education institute, and a regional intergovernmental organization. A separate set of Windows credential stealers were delivered via fake update-themed social engineering lures, alongside companion payloads with full remote access capabilities designed specifically to freeze the victim machine's security updates, so newly published detection signatures would never reach the machine at all.

What Beam does and doesn't have to say about this

Stated plainly, as Beam's summary post already does for the report as a whole: Beam's scanner checks skill files and MCP configs on your own machine against 11 heuristic patterns before you run them. GTG-20006's toolkit — Windows implants, an Android RAT, an iOS exploit chain, DNS hijacking against third-party hospitality infrastructure, a self-rebuilding detection-evasion loop — is nation-state espionage tooling detected by Anthropic across its own account infrastructure and by network security vendors like Microsoft. None of that is in scope for a local, pre-execution scanner, and claiming otherwise would misstate what Beam actually does.

What does generalize: the same principle behind Beam's monitoring philosophy — watch what an agent's actions actually touch, not just what it was asked to do — is the same shift GTG-20006's own defenders had to make. A monitoring agent that autonomously rebuilds flagged code is a preview of what any purely static, signature-based defense should expect to face. It's also a reminder that AI-agent tooling itself — skills, MCP servers, Claude Code configurations — is worth the same scrutiny before you run it locally, which is the narrower, practical layer covered in Beam's guide to MCP security.

Indicators of compromise

The list below is Anthropic's own published IOCs for GTG-20006, current as of the report's September 2026 publication. Treat it as a point-in-time snapshot — domains and infrastructure tied to an active actor change.

Domains and hosts
ms365-live[.]com
teams.ms365-live[.]com
m365-owa[.]com
owa-ms365[.]com
ms365-device[.]com
mslivetest.duckdns[.]org
my-invite[.]org
chamber-ua[.]org
chathamhouse[.]eu
ukrinform-share[.]net
statistic-ms[.]live
static-ms[.]live
ad-g[.]org
docs-viewer[.]org
wa-connect[.]eu
mygreatmarket[.]org
mygreatmarket[.]com
cdncounter[.]net
static.cdncounter[.]net
stuseamandesilt[.]org
api.stuseamandesilt[.]org
cdn.stuseamandesilt[.]org
update.stuseamandesilt[.]org
itechx[.]tel
pdfviewer2024.b-cdn[.]net
meridian-protocol[.]org
meridiangroup-corp[.]com
projectnightcrawler[.]dev
metricwave[.]org
mgsend[.]org
wa-meeting[.]com
russianearabroad[.]com
russianearabroad[.]org

IP addresses
104.145.210[.]184
31.57.243[.]154
104.194.151[.]133
104.194.159[.]55
144.172.114[.]192
213.145.86[.]112
2.26.53[.]194
148.135.195[.]111
185.198.234[.]26
185.198.234[.]101
149.54.42[.]106
104.194.149[.]228
38.146.28[.]132
38.146.28[.]75

Email addresses
anna.manager@russianearabroad[.]net
events@embassy-protocol[.]int

File and process names
msedgeupdate_v3[.]exe
msedgeupdate[.]exe
version[.]dll
WUEngine[.]exe
DiagHost[.]exe
client_20260507093021_4286d211_x64[.]exe
fix_network[.]apk

File hashes (SHA-256)
be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c
918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593

Related reading

• Anthropic's September 2026 threat intelligence report — the full summary this post extends
• Detecting and countering misuse of AI: September 2026 — Anthropic's original report
• GTG-50014: ShinyHunters and "vibe hacking" at scale
• GTG-10007: the autonomous exploit foundry
• The AI supply chain as target, loot, and attack compute
• GTG-50020: from hotel bookings to the AI supply chain
• GTG-50029: the one-person hacktivist doxxing platform
• What is AI agent monitoring?
• MCP security: a practical guide to tool poisoning and rug pulls
• AI agent security incidents: a timeline

This post reflects Anthropic's September 2026 threat intelligence report as published. GTG-20006 case details, malware names, targeting figures, and indicators of compromise are Anthropic's own; Beam's product scope statements are current as of publication and describe local, pre-execution scanning only.